<!DOCTYPE html>
<html class='v2' dir='ltr' lang='en' xmlns='http://www.w3.org/1999/xhtml' xmlns:b='http://www.google.com/2005/gml/b' xmlns:data='http://www.google.com/2005/gml/data' xmlns:expr='http://www.google.com/2005/gml/expr'>
<head>
<link href='https://www.blogger.com/static/v1/widgets/3566091532-css_bundle_v2.css' rel='stylesheet' type='text/css'/>
<meta content='width=1100' name='viewport'/>
<meta content='text/html; charset=UTF-8' http-equiv='Content-Type'/>
<meta content='blogger' name='generator'/>
<link href='https://seanpesce.blogspot.com/favicon.ico' rel='icon' type='image/x-icon'/>
<link href='https://seanpesce.blogspot.com/2023/05/bypassing-selinux-with-initmodule.html' rel='canonical'/>
<link rel="alternate" type="application/atom+xml" title="Sean Pesce&#39;s Blog - Atom" href="https://seanpesce.blogspot.com/feeds/posts/default" />
<link rel="alternate" type="application/rss+xml" title="Sean Pesce&#39;s Blog - RSS" href="https://seanpesce.blogspot.com/feeds/posts/default?alt=rss" />
<link rel="service.post" type="application/atom+xml" title="Sean Pesce&#39;s Blog - Atom" href="https://www.blogger.com/feeds/6232022754684573309/posts/default" />

<link rel="alternate" type="application/atom+xml" title="Sean Pesce&#39;s Blog - Atom" href="https://seanpesce.blogspot.com/feeds/5346021426681410298/comments/default" />
<!--Can't find substitution for tag [blog.ieCssRetrofitLinks]-->
<meta content='https://seanpesce.blogspot.com/2023/05/bypassing-selinux-with-initmodule.html' property='og:url'/>
<meta content='Bypassing SELinux with init_module' property='og:title'/>
<meta content='      TL;DR           There are two     Linux system calls      for loading a kernel module - init_module  and finit_module . By leveraging ...' property='og:description'/>
<title>Sean Pesce's Blog: Bypassing SELinux with init_module</title>
<style id='page-skin-1' type='text/css'><!--
/*
-----------------------------------------------
Blogger Template Style
Name:     Simple
Designer: Blogger
URL:      www.blogger.com
----------------------------------------------- */
/* Variable definitions
====================
<Variable name="keycolor" description="Main Color" type="color" default="#66bbdd"/>
<Group description="Page Text" selector="body">
<Variable name="body.font" description="Font" type="font"
default="normal normal 12px Arial, Tahoma, Helvetica, FreeSans, sans-serif"/>
<Variable name="body.text.color" description="Text Color" type="color" default="#222222"/>
</Group>
<Group description="Backgrounds" selector=".body-fauxcolumns-outer">
<Variable name="body.background.color" description="Outer Background" type="color" default="#66bbdd"/>
<Variable name="content.background.color" description="Main Background" type="color" default="#ffffff"/>
<Variable name="header.background.color" description="Header Background" type="color" default="transparent"/>
</Group>
<Group description="Links" selector=".main-outer">
<Variable name="link.color" description="Link Color" type="color" default="#2288bb"/>
<Variable name="link.visited.color" description="Visited Color" type="color" default="#888888"/>
<Variable name="link.hover.color" description="Hover Color" type="color" default="#33aaff"/>
</Group>
<Group description="Blog Title" selector=".header h1">
<Variable name="header.font" description="Font" type="font"
default="normal normal 60px Arial, Tahoma, Helvetica, FreeSans, sans-serif"/>
<Variable name="header.text.color" description="Title Color" type="color" default="#3399bb" />
</Group>
<Group description="Blog Description" selector=".header .description">
<Variable name="description.text.color" description="Description Color" type="color"
default="#777777" />
</Group>
<Group description="Tabs Text" selector=".tabs-inner .widget li a">
<Variable name="tabs.font" description="Font" type="font"
default="normal normal 14px Arial, Tahoma, Helvetica, FreeSans, sans-serif"/>
<Variable name="tabs.text.color" description="Text Color" type="color" default="#999999"/>
<Variable name="tabs.selected.text.color" description="Selected Color" type="color" default="#000000"/>
</Group>
<Group description="Tabs Background" selector=".tabs-outer .PageList">
<Variable name="tabs.background.color" description="Background Color" type="color" default="#f5f5f5"/>
<Variable name="tabs.selected.background.color" description="Selected Color" type="color" default="#eeeeee"/>
</Group>
<Group description="Post Title" selector="h3.post-title, .comments h4">
<Variable name="post.title.font" description="Font" type="font"
default="normal normal 22px Arial, Tahoma, Helvetica, FreeSans, sans-serif"/>
</Group>
<Group description="Date Header" selector=".date-header">
<Variable name="date.header.color" description="Text Color" type="color"
default="#cccccc"/>
<Variable name="date.header.background.color" description="Background Color" type="color"
default="transparent"/>
<Variable name="date.header.font" description="Text Font" type="font"
default="normal bold 11px Arial, Tahoma, Helvetica, FreeSans, sans-serif"/>
<Variable name="date.header.padding" description="Date Header Padding" type="string" default="inherit"/>
<Variable name="date.header.letterspacing" description="Date Header Letter Spacing" type="string" default="inherit"/>
<Variable name="date.header.margin" description="Date Header Margin" type="string" default="inherit"/>
</Group>
<Group description="Post Footer" selector=".post-footer">
<Variable name="post.footer.text.color" description="Text Color" type="color" default="#666666"/>
<Variable name="post.footer.background.color" description="Background Color" type="color"
default="#f9f9f9"/>
<Variable name="post.footer.border.color" description="Shadow Color" type="color" default="#eeeeee"/>
</Group>
<Group description="Gadgets" selector="h2">
<Variable name="widget.title.font" description="Title Font" type="font"
default="normal bold 11px Arial, Tahoma, Helvetica, FreeSans, sans-serif"/>
<Variable name="widget.title.text.color" description="Title Color" type="color" default="#000000"/>
<Variable name="widget.alternate.text.color" description="Alternate Color" type="color" default="#999999"/>
</Group>
<Group description="Images" selector=".main-inner">
<Variable name="image.background.color" description="Background Color" type="color" default="#ffffff"/>
<Variable name="image.border.color" description="Border Color" type="color" default="#eeeeee"/>
<Variable name="image.text.color" description="Caption Text Color" type="color" default="#cccccc"/>
</Group>
<Group description="Accents" selector=".content-inner">
<Variable name="body.rule.color" description="Separator Line Color" type="color" default="#eeeeee"/>
<Variable name="tabs.border.color" description="Tabs Border Color" type="color" default="#404040"/>
</Group>
<Variable name="body.background" description="Body Background" type="background"
color="#292929" default="$(color) none repeat scroll top left"/>
<Variable name="body.background.override" description="Body Background Override" type="string" default=""/>
<Variable name="body.background.gradient.cap" description="Body Gradient Cap" type="url"
default="url(https://resources.blogblog.com/blogblog/data/1kt/simple/gradients_light.png)"/>
<Variable name="body.background.gradient.tile" description="Body Gradient Tile" type="url"
default="url(https://resources.blogblog.com/blogblog/data/1kt/simple/body_gradient_tile_light.png)"/>
<Variable name="content.background.color.selector" description="Content Background Color Selector" type="string" default=".content-inner"/>
<Variable name="content.padding" description="Content Padding" type="length" default="10px" min="0" max="100px"/>
<Variable name="content.padding.horizontal" description="Content Horizontal Padding" type="length" default="10px" min="0" max="100px"/>
<Variable name="content.shadow.spread" description="Content Shadow Spread" type="length" default="40px" min="0" max="100px"/>
<Variable name="content.shadow.spread.webkit" description="Content Shadow Spread (WebKit)" type="length" default="5px" min="0" max="100px"/>
<Variable name="content.shadow.spread.ie" description="Content Shadow Spread (IE)" type="length" default="10px" min="0" max="100px"/>
<Variable name="main.border.width" description="Main Border Width" type="length" default="0" min="0" max="10px"/>
<Variable name="header.background.gradient" description="Header Gradient" type="url" default="none"/>
<Variable name="header.shadow.offset.left" description="Header Shadow Offset Left" type="length" default="-1px" min="-50px" max="50px"/>
<Variable name="header.shadow.offset.top" description="Header Shadow Offset Top" type="length" default="-1px" min="-50px" max="50px"/>
<Variable name="header.shadow.spread" description="Header Shadow Spread" type="length" default="1px" min="0" max="100px"/>
<Variable name="header.padding" description="Header Padding" type="length" default="30px" min="0" max="100px"/>
<Variable name="header.border.size" description="Header Border Size" type="length" default="1px" min="0" max="10px"/>
<Variable name="header.bottom.border.size" description="Header Bottom Border Size" type="length" default="1px" min="0" max="10px"/>
<Variable name="header.border.horizontalsize" description="Header Horizontal Border Size" type="length" default="0" min="0" max="10px"/>
<Variable name="description.text.size" description="Description Text Size" type="string" default="140%"/>
<Variable name="tabs.margin.top" description="Tabs Margin Top" type="length" default="0" min="0" max="100px"/>
<Variable name="tabs.margin.side" description="Tabs Side Margin" type="length" default="30px" min="0" max="100px"/>
<Variable name="tabs.background.gradient" description="Tabs Background Gradient" type="url"
default="url(https://resources.blogblog.com/blogblog/data/1kt/simple/gradients_light.png)"/>
<Variable name="tabs.border.width" description="Tabs Border Width" type="length" default="1px" min="0" max="10px"/>
<Variable name="tabs.bevel.border.width" description="Tabs Bevel Border Width" type="length" default="1px" min="0" max="10px"/>
<Variable name="post.margin.bottom" description="Post Bottom Margin" type="length" default="25px" min="0" max="100px"/>
<Variable name="image.border.small.size" description="Image Border Small Size" type="length" default="2px" min="0" max="10px"/>
<Variable name="image.border.large.size" description="Image Border Large Size" type="length" default="5px" min="0" max="10px"/>
<Variable name="page.width.selector" description="Page Width Selector" type="string" default=".region-inner"/>
<Variable name="page.width" description="Page Width" type="string" default="auto"/>
<Variable name="main.section.margin" description="Main Section Margin" type="length" default="15px" min="0" max="100px"/>
<Variable name="main.padding" description="Main Padding" type="length" default="15px" min="0" max="100px"/>
<Variable name="main.padding.top" description="Main Padding Top" type="length" default="30px" min="0" max="100px"/>
<Variable name="main.padding.bottom" description="Main Padding Bottom" type="length" default="30px" min="0" max="100px"/>
<Variable name="paging.background"
color="#333333"
description="Background of blog paging area" type="background"
default="transparent none no-repeat scroll top center"/>
<Variable name="footer.bevel" description="Bevel border length of footer" type="length" default="0" min="0" max="10px"/>
<Variable name="mobile.background.overlay" description="Mobile Background Overlay" type="string"
default="transparent none repeat scroll top left"/>
<Variable name="mobile.background.size" description="Mobile Background Size" type="string" default="auto"/>
<Variable name="mobile.button.color" description="Mobile Button Color" type="color" default="#ffffff" />
<Variable name="startSide" description="Side where text starts in blog language" type="automatic" default="left"/>
<Variable name="endSide" description="Side where text ends in blog language" type="automatic" default="right"/>
*/
/* Content
----------------------------------------------- */
body {
font: normal normal 12px Arial, Tahoma, Helvetica, FreeSans, sans-serif;
color: #cccccc;
background: #292929 none repeat scroll top left;
padding: 0 40px 40px 40px;
}
html body .region-inner {
min-width: 0;
max-width: 100%;
width: auto;
}
h2 {
font-size: 22px;
}
a:link {
text-decoration:none;
color: #dd7700;
}
a:visited {
text-decoration:none;
color: #cc6600;
}
a:hover {
text-decoration:underline;
color: #cc6600;
}
.body-fauxcolumn-outer .fauxcolumn-inner {
background: transparent none repeat scroll top left;
_background-image: none;
}
.body-fauxcolumn-outer .cap-top {
position: absolute;
z-index: 1;
height: 400px;
width: 100%;
}
.body-fauxcolumn-outer .cap-top .cap-left {
width: 100%;
background: transparent none repeat-x scroll top left;
_background-image: none;
}
.content-outer {
-moz-box-shadow: 0 0 40px rgba(0, 0, 0, .15);
-webkit-box-shadow: 0 0 5px rgba(0, 0, 0, .15);
-goog-ms-box-shadow: 0 0 10px #333333;
box-shadow: 0 0 40px rgba(0, 0, 0, .15);
margin-bottom: 1px;
}
.content-inner {
padding: 10px 10px;
}
.content-inner {
background-color: #333333;
}
/* Header
----------------------------------------------- */
.header-outer {
background: transparent none repeat-x scroll 0 -400px;
_background-image: none;
}
.Header h1 {
font: normal normal 60px Arial, Tahoma, Helvetica, FreeSans, sans-serif;
color: #ffffff;
text-shadow: -1px -1px 1px rgba(0, 0, 0, .2);
}
.Header h1 a {
color: #ffffff;
}
.Header .description {
font-size: 140%;
color: #aaaaaa;
}
.header-inner .Header .titlewrapper {
padding: 22px 30px;
}
.header-inner .Header .descriptionwrapper {
padding: 0 30px;
}
/* Tabs
----------------------------------------------- */
.tabs-inner .section:first-child {
border-top: 1px solid #404040;
}
.tabs-inner .section:first-child ul {
margin-top: -1px;
border-top: 1px solid #404040;
border-left: 0 solid #404040;
border-right: 0 solid #404040;
}
.tabs-inner .widget ul {
background: #222222 none repeat-x scroll 0 -800px;
_background-image: none;
border-bottom: 1px solid #404040;
margin-top: 0;
margin-left: -30px;
margin-right: -30px;
}
.tabs-inner .widget li a {
display: inline-block;
padding: .6em 1em;
font: normal normal 14px Arial, Tahoma, Helvetica, FreeSans, sans-serif;
color: #999999;
border-left: 1px solid #333333;
border-right: 0 solid #404040;
}
.tabs-inner .widget li:first-child a {
border-left: none;
}
.tabs-inner .widget li.selected a, .tabs-inner .widget li a:hover {
color: #ffffff;
background-color: #000000;
text-decoration: none;
}
/* Columns
----------------------------------------------- */
.main-outer {
border-top: 0 solid #404040;
}
.fauxcolumn-left-outer .fauxcolumn-inner {
border-right: 1px solid #404040;
}
.fauxcolumn-right-outer .fauxcolumn-inner {
border-left: 1px solid #404040;
}
/* Headings
----------------------------------------------- */
div.widget > h2,
div.widget h2.title {
margin: 0 0 1em 0;
font: normal bold 11px Arial, Tahoma, Helvetica, FreeSans, sans-serif;
color: #ffffff;
}
/* Widgets
----------------------------------------------- */
.widget .zippy {
color: #999999;
text-shadow: 2px 2px 1px rgba(0, 0, 0, .1);
}
.widget .popular-posts ul {
list-style: none;
}
/* Posts
----------------------------------------------- */
h2.date-header {
font: normal bold 11px Arial, Tahoma, Helvetica, FreeSans, sans-serif;
}
.date-header span {
background-color: transparent;
color: #cccccc;
padding: inherit;
letter-spacing: inherit;
margin: inherit;
}
.main-inner {
padding-top: 30px;
padding-bottom: 30px;
}
.main-inner .column-center-inner {
padding: 0 15px;
}
.main-inner .column-center-inner .section {
margin: 0 15px;
}
.post {
margin: 0 0 25px 0;
}
h3.post-title, .comments h4 {
font: normal normal 22px Arial, Tahoma, Helvetica, FreeSans, sans-serif;
margin: .75em 0 0;
}
.post-body {
font-size: 110%;
line-height: 1.4;
position: relative;
}
.post-body img, .post-body .tr-caption-container, .Profile img, .Image img,
.BlogList .item-thumbnail img {
padding: 0;
background: #111111;
border: 1px solid #111111;
-moz-box-shadow: 1px 1px 5px rgba(0, 0, 0, .1);
-webkit-box-shadow: 1px 1px 5px rgba(0, 0, 0, .1);
box-shadow: 1px 1px 5px rgba(0, 0, 0, .1);
}
.post-body img, .post-body .tr-caption-container {
padding: 1px;
}
.post-body .tr-caption-container {
color: #cccccc;
}
.post-body .tr-caption-container img {
padding: 0;
background: transparent;
border: none;
-moz-box-shadow: 0 0 0 rgba(0, 0, 0, .1);
-webkit-box-shadow: 0 0 0 rgba(0, 0, 0, .1);
box-shadow: 0 0 0 rgba(0, 0, 0, .1);
}
.post-header {
margin: 0 0 1.5em;
line-height: 1.6;
font-size: 90%;
}
.post-footer {
margin: 20px -2px 0;
padding: 5px 10px;
color: #888888;
background-color: #303030;
border-bottom: 1px solid #444444;
line-height: 1.6;
font-size: 90%;
}
#comments .comment-author {
padding-top: 1.5em;
border-top: 1px solid #404040;
background-position: 0 1.5em;
}
#comments .comment-author:first-child {
padding-top: 0;
border-top: none;
}
.avatar-image-container {
margin: .2em 0 0;
}
#comments .avatar-image-container img {
border: 1px solid #111111;
}
/* Comments
----------------------------------------------- */
.comments .comments-content .icon.blog-author {
background-repeat: no-repeat;
background-image: url();
}
.comments .comments-content .loadmore a {
border-top: 1px solid #999999;
border-bottom: 1px solid #999999;
}
.comments .comment-thread.inline-thread {
background-color: #303030;
}
.comments .continue {
border-top: 2px solid #999999;
}
/* Accents
---------------------------------------------- */
.section-columns td.columns-cell {
border-left: 1px solid #404040;
}
.blog-pager {
background: transparent none no-repeat scroll top center;
}
.blog-pager-older-link, .home-link,
.blog-pager-newer-link {
background-color: #333333;
padding: 5px;
}
.footer-outer {
border-top: 0 dashed #bbbbbb;
}
/* Mobile
----------------------------------------------- */
body.mobile  {
background-size: auto;
}
.mobile .body-fauxcolumn-outer {
background: transparent none repeat scroll top left;
}
.mobile .body-fauxcolumn-outer .cap-top {
background-size: 100% auto;
}
.mobile .content-outer {
-webkit-box-shadow: 0 0 3px rgba(0, 0, 0, .15);
box-shadow: 0 0 3px rgba(0, 0, 0, .15);
}
.mobile .tabs-inner .widget ul {
margin-left: 0;
margin-right: 0;
}
.mobile .post {
margin: 0;
}
.mobile .main-inner .column-center-inner .section {
margin: 0;
}
.mobile .date-header span {
padding: 0.1em 10px;
margin: 0 -10px;
}
.mobile h3.post-title {
margin: 0;
}
.mobile .blog-pager {
background: transparent none no-repeat scroll top center;
}
.mobile .footer-outer {
border-top: none;
}
.mobile .main-inner, .mobile .footer-inner {
background-color: #333333;
}
.mobile-index-contents {
color: #cccccc;
}
.mobile-link-button {
background-color: #dd7700;
}
.mobile-link-button a:link, .mobile-link-button a:visited {
color: #ffffff;
}
.mobile .tabs-inner .section:first-child {
border-top: none;
}
.mobile .tabs-inner .PageList .widget-content {
background-color: #000000;
color: #ffffff;
border-top: 1px solid #404040;
border-bottom: 1px solid #404040;
}
.mobile .tabs-inner .PageList .widget-content .pagelist-arrow {
border-left: 1px solid #404040;
}

--></style>
<style id='template-skin-1' type='text/css'><!--
body {
min-width: 700px;
}
.content-outer, .content-fauxcolumn-outer, .region-inner {
min-width: 700px;
max-width: 700px;
_width: 700px;
}
.main-inner .columns {
padding-left: 0px;
padding-right: 0px;
}
.main-inner .fauxcolumn-center-outer {
left: 0px;
right: 0px;
/* IE6 does not respect left and right together */
_width: expression(this.parentNode.offsetWidth -
parseInt("0px") -
parseInt("0px") + 'px');
}
.main-inner .fauxcolumn-left-outer {
width: 0px;
}
.main-inner .fauxcolumn-right-outer {
width: 0px;
}
.main-inner .column-left-outer {
width: 0px;
right: 100%;
margin-left: -0px;
}
.main-inner .column-right-outer {
width: 0px;
margin-right: -0px;
}
#layout {
min-width: 0;
}
#layout .content-outer {
min-width: 0;
width: 800px;
}
#layout .region-inner {
min-width: 0;
width: auto;
}
body#layout div.add_widget {
padding: 8px;
}
body#layout div.add_widget a {
margin-left: 32px;
}
--></style>
<link crossorigin='anonymous' href='https://cdnjs.cloudflare.com/ajax/libs/highlight.js/11.6.0/styles/default.min.css' integrity='sha512-hasIneQUHlh06VNBe7f6ZcHmeRTLIaQWFd43YriJ0UND19bvYRauxthDg8E4eVNPm9bRUhr5JGeqH7FRFXQu5g==' referrerpolicy='no-referrer' rel='stylesheet'/>
<script crossorigin='anonymous' integrity='sha512-gU7kztaQEl7SHJyraPfZLQCNnrKdaQi5ndOyt4L4UPL/FHDd/uB9Je6KDARIqwnNNE27hnqoWLBq+Kpe4iHfeQ==' referrerpolicy='no-referrer' src='https://cdnjs.cloudflare.com/ajax/libs/highlight.js/11.6.0/highlight.min.js'></script>
<script>hljs.highlightAll();</script>
<link href='https://www.blogger.com/dyn-css/authorization.css?targetBlogID=6232022754684573309&amp;zx=82274610-4a2a-47a1-bc8f-84bbbd48e359' media='none' onload='if(media!=&#39;all&#39;)media=&#39;all&#39;' rel='stylesheet'/><noscript><link href='https://www.blogger.com/dyn-css/authorization.css?targetBlogID=6232022754684573309&amp;zx=82274610-4a2a-47a1-bc8f-84bbbd48e359' rel='stylesheet'/></noscript>
<meta name='google-adsense-platform-account' content='ca-host-pub-1556223355139109'/>
<meta name='google-adsense-platform-domain' content='blogspot.com'/>

<script type="text/javascript" language="javascript">
  // Supply ads personalization default for EEA readers
  // See https://www.blogger.com/go/adspersonalization
  adsbygoogle = window.adsbygoogle || [];
  if (typeof adsbygoogle.requestNonPersonalizedAds === 'undefined') {
    adsbygoogle.requestNonPersonalizedAds = 1;
  }
</script>


<link rel="stylesheet" href="https://fonts.googleapis.com/css2?display=swap&family=Consolas"></head>
<body class='loading'><span hidden='true'><a href='https://infosec.exchange/@SeanPesce' rel='me'>Mastodon</a></span>
<div class='navbar section' id='navbar' name='Navbar'><div class='widget Navbar' data-version='1' id='Navbar1'><script type="text/javascript">
    function setAttributeOnload(object, attribute, val) {
      if(window.addEventListener) {
        window.addEventListener('load',
          function(){ object[attribute] = val; }, false);
      } else {
        window.attachEvent('onload', function(){ object[attribute] = val; });
      }
    }
  </script>
<div id="navbar-iframe-container"></div>
<script type="text/javascript" src="https://apis.google.com/js/platform.js"></script>
<script type="text/javascript">
      gapi.load("gapi.iframes:gapi.iframes.style.bubble", function() {
        if (gapi.iframes && gapi.iframes.getContext) {
          gapi.iframes.getContext().openChild({
              url: 'https://www.blogger.com/navbar.g?targetBlogID\x3d6232022754684573309\x26blogName\x3dSean+Pesce\x27s+Blog\x26publishMode\x3dPUBLISH_MODE_BLOGSPOT\x26navbarType\x3dLIGHT\x26layoutType\x3dLAYOUTS\x26searchRoot\x3dhttps://seanpesce.blogspot.com/search\x26blogLocale\x3den\x26v\x3d2\x26homepageUrl\x3dhttps://seanpesce.blogspot.com/\x26targetPostID\x3d5346021426681410298\x26blogPostOrPageUrl\x3dhttps://seanpesce.blogspot.com/2023/05/bypassing-selinux-with-initmodule.html\x26vt\x3d2982157340573298254',
              where: document.getElementById("navbar-iframe-container"),
              id: "navbar-iframe"
          });
        }
      });
    </script><script type="text/javascript">
(function() {
var script = document.createElement('script');
script.type = 'text/javascript';
script.src = '//pagead2.googlesyndication.com/pagead/js/google_top_exp.js';
var head = document.getElementsByTagName('head')[0];
if (head) {
head.appendChild(script);
}})();
</script>
</div></div>
<div class='body-fauxcolumns'>
<div class='fauxcolumn-outer body-fauxcolumn-outer'>
<div class='cap-top'>
<div class='cap-left'></div>
<div class='cap-right'></div>
</div>
<div class='fauxborder-left'>
<div class='fauxborder-right'></div>
<div class='fauxcolumn-inner'>
</div>
</div>
<div class='cap-bottom'>
<div class='cap-left'></div>
<div class='cap-right'></div>
</div>
</div>
</div>
<div class='content'>
<div class='content-fauxcolumns'>
<div class='fauxcolumn-outer content-fauxcolumn-outer'>
<div class='cap-top'>
<div class='cap-left'></div>
<div class='cap-right'></div>
</div>
<div class='fauxborder-left'>
<div class='fauxborder-right'></div>
<div class='fauxcolumn-inner'>
</div>
</div>
<div class='cap-bottom'>
<div class='cap-left'></div>
<div class='cap-right'></div>
</div>
</div>
</div>
<div class='content-outer'>
<div class='content-cap-top cap-top'>
<div class='cap-left'></div>
<div class='cap-right'></div>
</div>
<div class='fauxborder-left content-fauxborder-left'>
<div class='fauxborder-right content-fauxborder-right'></div>
<div class='content-inner'>
<header>
<div class='header-outer'>
<div class='header-cap-top cap-top'>
<div class='cap-left'></div>
<div class='cap-right'></div>
</div>
<div class='fauxborder-left header-fauxborder-left'>
<div class='fauxborder-right header-fauxborder-right'></div>
<div class='region-inner header-inner'>
<div class='header section' id='header' name='Header'><div class='widget Header' data-version='1' id='Header1'>
<div id='header-inner'>
<div class='titlewrapper'>
<h1 class='title'>
<a href='https://seanpesce.blogspot.com/'>
Sean Pesce's Blog
</a>
</h1>
</div>
<div class='descriptionwrapper'>
<p class='description'><span>
</span></p>
</div>
</div>
</div></div>
</div>
</div>
<div class='header-cap-bottom cap-bottom'>
<div class='cap-left'></div>
<div class='cap-right'></div>
</div>
</div>
</header>
<div class='tabs-outer'>
<div class='tabs-cap-top cap-top'>
<div class='cap-left'></div>
<div class='cap-right'></div>
</div>
<div class='fauxborder-left tabs-fauxborder-left'>
<div class='fauxborder-right tabs-fauxborder-right'></div>
<div class='region-inner tabs-inner'>
<div class='tabs no-items section' id='crosscol' name='Cross-Column'></div>
<div class='tabs no-items section' id='crosscol-overflow' name='Cross-Column 2'></div>
</div>
</div>
<div class='tabs-cap-bottom cap-bottom'>
<div class='cap-left'></div>
<div class='cap-right'></div>
</div>
</div>
<div class='main-outer'>
<div class='main-cap-top cap-top'>
<div class='cap-left'></div>
<div class='cap-right'></div>
</div>
<div class='fauxborder-left main-fauxborder-left'>
<div class='fauxborder-right main-fauxborder-right'></div>
<div class='region-inner main-inner'>
<div class='columns fauxcolumns'>
<div class='fauxcolumn-outer fauxcolumn-center-outer'>
<div class='cap-top'>
<div class='cap-left'></div>
<div class='cap-right'></div>
</div>
<div class='fauxborder-left'>
<div class='fauxborder-right'></div>
<div class='fauxcolumn-inner'>
</div>
</div>
<div class='cap-bottom'>
<div class='cap-left'></div>
<div class='cap-right'></div>
</div>
</div>
<div class='fauxcolumn-outer fauxcolumn-left-outer'>
<div class='cap-top'>
<div class='cap-left'></div>
<div class='cap-right'></div>
</div>
<div class='fauxborder-left'>
<div class='fauxborder-right'></div>
<div class='fauxcolumn-inner'>
</div>
</div>
<div class='cap-bottom'>
<div class='cap-left'></div>
<div class='cap-right'></div>
</div>
</div>
<div class='fauxcolumn-outer fauxcolumn-right-outer'>
<div class='cap-top'>
<div class='cap-left'></div>
<div class='cap-right'></div>
</div>
<div class='fauxborder-left'>
<div class='fauxborder-right'></div>
<div class='fauxcolumn-inner'>
</div>
</div>
<div class='cap-bottom'>
<div class='cap-left'></div>
<div class='cap-right'></div>
</div>
</div>
<!-- corrects IE6 width calculation -->
<div class='columns-inner'>
<div class='column-center-outer'>
<div class='column-center-inner'>
<div class='main section' id='main' name='Main'><div class='widget Blog' data-version='1' id='Blog1'>
<div class='blog-posts hfeed'>

          <div class="date-outer">
        
<h2 class='date-header'><span>Friday, May 26, 2023</span></h2>

          <div class="date-posts">
        
<div class='post-outer'>
<div class='post hentry uncustomized-post-template' itemprop='blogPost' itemscope='itemscope' itemtype='http://schema.org/BlogPosting'>
<meta content='6232022754684573309' itemprop='blogId'/>
<meta content='5346021426681410298' itemprop='postId'/>
<a name='5346021426681410298'></a>
<h3 class='post-title entry-title' itemprop='name'>
Bypassing SELinux with init_module
</h3>
<div class='post-header'>
<div class='post-header-line-1'></div>
</div>
<div class='post-body entry-content' id='post-body-5346021426681410298' itemprop='description articleBody'>
<p>&nbsp;</p>
<h3 style="text-align: center;">
  <span style="font-family: arial; font-size: large;">TL;DR</span>
</h3>
<div>
  <span style="font-family: arial;"><br /></span>
</div>
<div>
  <span style="font-family: arial;">There are two
    <a href="https://en.wikibooks.org/wiki/The_Linux_Kernel/Syscalls">Linux system calls</a>
    for loading a kernel module - </span><span style="font-family: courier;">init_module</span><span style="font-family: arial;"> and </span><span style="font-family: courier;">finit_module</span><span style="font-family: arial;">. By leveraging </span><span style="font-family: courier;">init_module</span><span style="font-family: arial;">, I bypassed a filesystem-based SELinux rule that prevented me from loading
    a kernel module through traditional means (e.g., </span><span style="font-family: courier;">insmod</span><span style="font-family: arial;">). I then disabled SELinux from kernel-space. Proof of concept
    code&nbsp;</span><span style="font-family: arial;">can be found on my&nbsp;<a href="https://github.com/SeanPesce/SELinux-Kernel-Module-Bypass">GitHub</a></span><span style="font-family: arial;">.</span>
</div>
<div>
  <span style="font-family: arial;"><br /></span><span style="font-family: arial;"><a name='more'></a></span>
</div>
<h3 style="text-align: center;">
  <span style="font-family: arial;">&nbsp;<span style="font-size: large;">Scenario</span></span>
</h3>
<p><span style="font-family: arial;">Recently I've been looking at an undisclosed Linux-based device as a personal weekend side project. Using some simple techniques that I won't discuss here, I had acquired
    root shell access. To avoid disclosing unnecessary details about the
    target implementation, information such as file names and SELinux contexts
    have been modified in the write-up below. Some code snippets and shell
    output listings have also been truncated for brevity (indicated by "</span><span style="font-family: courier;">[...]</span><span style="font-family: arial;">").</span>
</p>
<h3 style="text-align: center;">
  <span style="font-family: arial; font-size: large;">SELinux</span>
</h3>
<p>
  <span style="font-family: arial;">Upon connecting with my reverse shell, I quickly realized that the system
    had
    <a href="https://en.wikipedia.org/wiki/Security-Enhanced_Linux">SELinux</a>
    enabled. Although the policy wasn't nearly as strict as the standard policy
    that you might find on a typical Android device, it was strict enough to
    prevent me from doing a lot of useful things (e.g., mounting filesystems and
    accessing files in </span><span style="font-family: courier;">/etc/</span><span style="font-family: arial;">). Luckily, I was able to write and execute files in </span><span style="font-family: courier;">/tmp/</span><span style="font-family: arial;">, so I still had an easy way to build and run custom tools.</span>
</p>
<p>
  <span style="font-family: arial;">The developers did a good job of removing unnecessary user-space
    binaries from the filesystem, so the standard SELinux tools (</span><span style="font-family: courier;">getenforce</span><span style="font-family: arial;">, </span><span style="font-family: courier;">setenforce</span><span style="font-family: arial;">, </span><span style="font-family: courier;">sestatus</span><span style="font-family: arial;">, etc.) were unavailable. When I tried to manually interact with the
    SELinux </span><span style="font-family: courier;">enforce</span><span style="font-family: arial;"> file, I was unable to do so:</span>
</p>
<p></p>
<pre><code class="language-plaintext"># ls -la /sys/fs/selinux/enforce
ls: /sys/fs/selinux/enforce: Permission denied

# cat /sys/fs/selinux/enforce
cat: can't open '/sys/fs/selinux/enforce': Permission denied

# echo 0 &gt; /sys/fs/selinux/enforce
/bin/sh: can't create /sys/fs/selinux/enforce: Permission denied
</code></pre>
<p></p>
<p>
  <span style="font-family: arial;">An inspection of the system logs indicated that SELinux was preventing
    this:</span>
</p>
<p></p>
<pre><code class="language-plaintext"># dmesg | grep audit
[...]
[   57.800935] audit: type=1400 audit(1684520112.159:6): avc:  denied  { write } for  pid=524 comm="sh" name="enforce" dev="selinuxfs" ino=4 scontext=system_u:object_r:userapp_t tcontext=system_u:object_r:security_t tclass=file permissive=0
[...]
</code></pre>
<p></p>
<p><span style="font-family: arial;">Unsurprising, I guess.</span></p>
<h3 style="text-align: center;">
  <span style="font-family: arial; font-size: large;">Kernel Module</span>
</h3>
<p>
  <span style="font-family: arial;">After trying a number of failed techniques that aren't described here, I
    decided to see if I could get kernel execution. With kernel execution, I
    wouldn't necessarily <i>need</i> to disable SELinux, but it would make my
    life a lot easier if I wanted to do anything in user-space.</span>
</p>
<p>
  <span style="font-family: arial;">The easiest way to obtain kernel execution is to load a
    <a href="https://en.wikipedia.org/wiki/Loadable_kernel_module">kernel module</a>. The device was running on an ARM processor, so I figured it would
    be a lot of effort to cross-compile a custom kernel module, and I didn't
    want to expend that effort unless I was sure that I could load a module at
    all. I decided I would first make a simple proof of concept module
    that printed to the system log when loaded, thereby proving kernel
    execution.</span>
</p>
<p>
  <span style="font-family: arial;">I quickly cloned one of the existing kernel modules from the device
    filesystem using my semi-functional&nbsp;<a href="https://gist.github.com/SeanPesce/de3838d9becc53420199e17be273adf6">kernel module duplicator script</a>, and then patched the module constructor function (</span><span style="font-family: courier;"><a href="https://archive.kernel.org/oldlinux/htmldocs/kernel-hacking/routines-init-again.html">module_init</a></span><span style="font-family: arial;">) to print my canary message:</span>
</p>
<p></p>
<pre><code class="language-c">printk("\x01[SeanP] Loaded kernel module!\n");
</code></pre>
<p></p>
<p>
  <span style="font-family: arial;">If the module was successfully loaded, I would see the message in the
    output of </span><span style="font-family: courier;">dmesg</span><span style="font-family: arial;">.</span>
</p>
<p>
  <span style="font-family: arial;">I attempted to loaded the module with </span><span style="font-family: courier;">insmod</span><span style="font-family: arial;">:</span>
</p>
<p></p>
<pre><code class="language-plaintext"># insmod /tmp/dummy.ko
</code></pre>
<p></p>
<p>
  <span style="font-family: arial;">However, the system logs revealed (yet again) that SELinux was blocking
    it:</span>
</p>
<p></p>
<pre><code class="language-plaintext"># dmesg | grep audit
[...]
[ 1223.106922] audit: type=1400 audit(1680885266.249:5): avc:  denied  { module_load } for  pid=5658 comm="insmod" path="/tmp/dummy.ko" dev="tmpfs" ino=573 scontext=system_u:object_r:userapp_t tcontext=system_u:object_r:tmpfs_t tclass=system permissive=0
[...]
</code></pre>
<p></p>
<p><span style="font-family: arial;">Frustrating, but expected.</span></p>
<h3 style="text-align: center;">
  <span style="font-family: arial; font-size: large;">init_module</span>
</h3>
<p>
  <span style="font-family: arial;">While reading various documentation about kernel functionality and Linux
    system calls, I discovered that there are actually two different system
    calls that can be used to load a kernel module:</span>
</p>
<p></p>
<pre><code class="language-c">int init_module(void* module_image, unsigned long len, const char* param_values);

int finit_module(int fd, const char* param_values, int flags);
</code></pre>
<p></p>
<p>
  <span style="font-family: arial;">The
    <a href="https://linux.die.net/man/2/init_module">documentation</a> explains
    the difference:</span>
</p>
<blockquote style="border: none; margin: 0px 0px 0px 40px; padding: 0px;">
  <p>
    <i><span style="font-family: courier;"><b>init_module()</b></span><span style="font-family: arial;">
        loads an ELF image into kernel space, performs any necessary symbol
        relocations, initializes module parameters to values provided by the
        caller, and then runs the module's </span><span style="font-family: courier;">init</span><span style="font-family: arial;">
        function. This system call requires privilege.</span></i>
  </p>
  <p>
    <i><span style="font-family: arial;">The </span><span style="font-family: courier;">module_image</span><span style="font-family: arial;">
        argument points to a buffer containing the binary image to be loaded; </span><span style="font-family: courier;">len</span><span style="font-family: arial;">
        specifies the size of that buffer. The module image should be a valid
        ELF image, built for the running kernel.</span></i>
  </p>
</blockquote>
<blockquote style="border: none; margin: 0px 0px 0px 40px; padding: 0px;">
  <p style="text-align: left;">&nbsp;[...]</p>
</blockquote>
<blockquote style="border: none; margin: 0px 0px 0px 40px; padding: 0px;">
  <i><span style="font-family: arial;">The </span><span style="font-family: courier;"><b>finit_module()</b></span><span style="font-family: arial;"> system call is like </span><span style="font-family: courier;">init_module()</span><span style="font-family: arial;">, but reads the module to be loaded from the file descriptor </span><span style="font-family: courier;">fd</span><span style="font-family: arial;">. It is useful when the authenticity of a kernel module can be determined
      from its location in the file system[.]</span></i>
</blockquote>
<p>
  <span style="font-family: arial;">So, </span><span style="font-family: courier;">init_module</span><span style="font-family: arial;">
    loads a kernel module stored in memory, while </span><span style="font-family: courier;">finit_module</span><span style="font-family: arial;"> loads a kernel module from disk.</span>
</p>
<p>
  <span style="font-family: arial;">Revisiting the SELinux audit message, I noticed that my attempt to load a
    kernel module was blocked (at least in part) due to the target context of
    the module file </span><span style="font-family: courier;">dummy.ko</span><span style="font-family: arial;">
    (which included the filesystem type&nbsp;</span><span style="font-family: courier;">tmpfs_t</span><span style="font-family: arial;">):</span>
</p>
<pre><code class="language-plaintext">tcontext=system_u:object_r:tmpfs_t
</code></pre>
<p></p>
<p>
  <span style="font-family: arial;">This seemed to indicate that </span><span style="font-family: courier;">insmod</span><span style="font-family: arial;"> was using the </span><span style="font-family: courier;">finit_module</span><span style="font-family: arial;">
    system call to load kernel modules.&nbsp;</span><span style="font-family: arial;">What if I tried to load a module with </span><span style="font-family: courier;">init_module</span><span style="font-family: arial;"> instead?&nbsp;</span><span style="font-family: arial;">Assuming that SELinux was enforcing this rule based on a filesystem context, I could load the module from a buffer in memory, and there wouldn't be any filesystem association.</span></p>
<h3 style="text-align: center;">
  <span style="font-family: arial; font-size: large;">Custom Loader</span>
</h3>
<p>
  <span style="font-family: arial;">I found an
    <a href="https://github.com/cirosantilli/linux-kernel-module-cheat/blob/91583552ba2c2d547c8577ac888ab9f851642b25/kernel_module/user/myinsmod.c">existing implementation of a kernel module loader</a>
    that uses </span><span style="font-family: courier;">init_module</span><span style="font-family: arial;">
    (created by&nbsp;<a href="https://github.com/cirosantilli">Ciro Santilli</a></span><span style="font-family: arial;">), modified it to add more error checks, and compiled it with&nbsp;</span><span style="font-family: courier;">arm-linux-gnueabi-gcc</span><span style="font-family: arial;">&nbsp;(final code and Makefile can be found
    <a href="https://github.com/SeanPesce/SELinux-Kernel-Module-Bypass/tree/main/loader">here</a>). Then, I attempted to load my kernel module with the custom loader:</span>
</p>
<p></p>
<pre><code class="language-plaintext"># /tmp/modload /tmp/dummy.ko

# dmesg | grep SeanP
[   10.466012] calling  dummy_module_init+0x0/0x1000 [SeanP_DummyModule] @ 119
[   10.466058] [SeanP] Loaded kernel module!
[   10.466194] initcall dummy_module_init+0x0/0x1000 [SeanP_DummyModule] returned 22 after 84 usecs
</code></pre>
<p></p>
<p>
  <span style="font-family: arial;">It worked! This was huge; I had obtained kernel execution. Even if I
    couldn't disable SELinux, I could do (basically) anything I wanted to do in
    user-space with a bit more effort from kernel-space.</span>
</p>
<h3 style="text-align: center;">
  <span style="font-family: arial; font-size: large;">Disabling SELinux</span>
</h3>
<p>
  <span style="font-family: arial;">Now that I knew I could load kernel modules, I needed to cross-compile a custom
    module to do anything more advanced (technically I could patch an existing
    module, but that would probably be more effort). I'm not going to get
    into the details of cross-compiling kernel artifacts, but
    <a href="https://blukat.me/2017/12/cross-compile-arm-kernel-module/">this post</a>
    from <a href="https://www.linkedin.com/in/blukat29/">Yunjong Jeong</a> (AKA
    <a href="https://github.com/blukat29">blukat29</a>) has lots of good
    information for anyone looking to do so.</span>
</p>
<p>
  <span style="font-family: arial;">Once I had my build environment set up, I needed to create the kernel
    module. After a bit of research, I determined that my module would need to
    do two things:</span>
</p>
<p></p>
<ul style="text-align: left;">
  <li>
    <span style="font-family: arial;">Shed the user-space SELinux context that the kernel module was loaded
      with</span>
  </li>
  <li>
    <span style="font-family: arial;">Write </span><span style="font-family: courier;">0</span><span style="font-family: arial;"> to&nbsp;</span><span style="font-family: courier;">/sys/fs/selinux/enforce</span>
  </li>
</ul>
<p></p>
<p>
  <span style="font-family: arial;">I'm sure you can also disable SELinux by modifying kernel data
    structures in memory, but my way seemed easier.</span>
</p>
<p>
  <span style="font-family: arial;"><a href="https://cloudfuzz.github.io/android-kernel-exploitation/chapters/linux-privilege-escalation.html#process-credentials">This post</a>
    by&nbsp;</span><span style="font-family: arial;"><a href="https://twitter.com/HackSysTeam">Ashfaq Ansari</a> has a lot of
    good information on Linux exploitation, including an explanation of how to get rid of your user-space SELinux context after transitioning
    to kernel-space:</span>
</p>
<p></p>
<pre><code class="language-c">commit_creds(prepare_kernel_cred(NULL));
</code></pre>
<p></p>
<p>
  <span style="font-family: arial;">Ashfaq thoroughly explains how this code works, but it can be briefly
    summarized with this quote:</span>
</p>
<blockquote style="border: none; margin: 0px 0px 0px 40px; padding: 0px;">
  <p style="text-align: left;">
    <span style="font-family: arial;">[...] if we provide </span><span style="font-family: courier;">NULL</span><span style="font-family: arial;"> as the pointer to </span><span style="font-family: courier;">task_struct</span><span style="font-family: arial;">
      it will get the default credentials which is </span><span style="font-family: courier;">init_cred</span><span style="font-family: arial;">. </span><span style="font-family: courier;">init_cred</span><span style="font-family: arial;"> is a global </span><span style="font-family: courier;">struct cred</span><span style="font-family: arial;"> defined in </span><span style="font-family: courier;">kernel/cred.c</span><span style="font-family: arial;">
      which is used to initialize the credentials for the </span><span style="font-family: courier;">init_task</span><span style="font-family: arial;"> which is the first task in Linux.</span>
  </p>
</blockquote>
<p>
  <span style="font-family: arial;">So we're not really <i>removing</i> the SELinux context; rather, we're
    transitioning to the context of the </span><span style="font-family: courier;">init</span><span style="font-family: arial;">
    task (generally speaking, this context probably has very few restrictions,
    if any).</span>
</p>
<p>
  <span style="font-family: arial;">My second goal (writing zero to the </span><span style="font-family: courier;">enforce</span><span style="font-family: arial;">
    file) was easier to figure out; I simply had to use the standard function
    for writing files from kernel-space (</span><span style="font-family: courier;"><a href="https://github.com/torvalds/linux/blob/master/fs/read_write.c#L548">kernel_write</a></span><span style="font-family: arial;">).</span>
</p>
<p>
  <span style="font-family: arial;">The final code for my kernel module was less than 100 lines (and can be
    found
    <a href="https://github.com/SeanPesce/SELinux-Kernel-Module-Bypass/blob/main/kernel_module/disable_selinux.c">here</a>). I compiled it and loaded it with my custom loader:</span>
</p>
<p></p>
<pre><code class="language-plaintext"># /tmp/modload /tmp/disable_selinux.ko

# dmesg | grep SeanP
[   35.808464] [SeanP] SELinux disabler kernel module loaded
[   35.818566] [SeanP] [SUCCESS] Wrote 0 to SELinux enforce file

# cat /sys/fs/selinux/enforce
0
</code></pre>
<p></p>
<p>
  <span style="font-family: arial;">And just like that, I had disabled SELinux.</span>
</p>
<div>
  <span><hr /></span>
</div>
<h3 style="text-align: center;">
  <span style="font-family: arial; font-size: large;">Resources</span>
</h3>
<p></p>
<p></p>
<p>
  <span style="font-family: arial;">Source code and build scripts for the custom tools I described in this blog
    post (module loader and kernel module) can be found on my
    <a href="https://github.com/SeanPesce/SELinux-Kernel-Module-Bypass">GitHub</a>. Below is a list of references that I found helpful during this
    adventure:</span>
</p>
<p></p>
<ul style="text-align: left;">
  <li>
    <span style="font-family: arial;"><a href="https://blukat.me/2017/12/cross-compile-arm-kernel-module/">Cross-compiling Linux Kernel Modules for ARM</a>
      by&nbsp;</span><a href="https://www.linkedin.com/in/blukat29/" style="font-family: arial;">Yunjong Jeong</a>
  </li>
  <li>
    <span style="font-family: arial;"><a href="https://cloudfuzz.github.io/android-kernel-exploitation/chapters/linux-privilege-escalation.html">Android Kernel Exploitation - Linux Privilege Escalation &amp;
        SELinux</a>
      by&nbsp;</span><a href="https://twitter.com/HackSysTeam" style="font-family: arial;">Ashfaq Ansari</a>
  </li>
  <li>
    <span style="font-family: arial;"><a href="https://github.com/SeanPesce/SELinux-Kernel-Module-Bypass/tree/main#:~:text=Linux%20Kernel%20Module%20Cheat%20Sheet">Linux Kernel Module Cheat Sheet</a>&nbsp;by&nbsp;</span><a href="https://github.com/cirosantilli" style="font-family: arial;">Ciro Santilli</a>
  </li>
</ul>
<p></p>
<p><br /></p>
<div style='clear: both;'></div>
</div>
<div class='post-footer'>
<div class='post-footer-line post-footer-line-1'>
<span class='post-author vcard'>
</span>
<span class='post-timestamp'>
at
<meta content='https://seanpesce.blogspot.com/2023/05/bypassing-selinux-with-initmodule.html' itemprop='url'/>
<a class='timestamp-link' href='https://seanpesce.blogspot.com/2023/05/bypassing-selinux-with-initmodule.html' rel='bookmark' title='permanent link'><abbr class='published' itemprop='datePublished' title='2023-05-26T08:17:00-05:00'>May 26, 2023</abbr></a>
</span>
<span class='post-comment-link'>
</span>
<span class='post-icons'>
<span class='item-control blog-admin pid-1286931690'>
<a href='https://www.blogger.com/post-edit.g?blogID=6232022754684573309&postID=5346021426681410298&from=pencil' title='Edit Post'>
<img alt='' class='icon-action' height='18' src='https://resources.blogblog.com/img/icon18_edit_allbkg.gif' width='18'/>
</a>
</span>
</span>
<div class='post-share-buttons goog-inline-block'>
<a class='goog-inline-block share-button sb-email' href='https://www.blogger.com/share-post.g?blogID=6232022754684573309&postID=5346021426681410298&target=email' target='_blank' title='Email This'><span class='share-button-link-text'>Email This</span></a><a class='goog-inline-block share-button sb-blog' href='https://www.blogger.com/share-post.g?blogID=6232022754684573309&postID=5346021426681410298&target=blog' onclick='window.open(this.href, "_blank", "height=270,width=475"); return false;' target='_blank' title='BlogThis!'><span class='share-button-link-text'>BlogThis!</span></a><a class='goog-inline-block share-button sb-twitter' href='https://www.blogger.com/share-post.g?blogID=6232022754684573309&postID=5346021426681410298&target=twitter' target='_blank' title='Share to Twitter'><span class='share-button-link-text'>Share to Twitter</span></a><a class='goog-inline-block share-button sb-facebook' href='https://www.blogger.com/share-post.g?blogID=6232022754684573309&postID=5346021426681410298&target=facebook' onclick='window.open(this.href, "_blank", "height=430,width=640"); return false;' target='_blank' title='Share to Facebook'><span class='share-button-link-text'>Share to Facebook</span></a><a class='goog-inline-block share-button sb-pinterest' href='https://www.blogger.com/share-post.g?blogID=6232022754684573309&postID=5346021426681410298&target=pinterest' target='_blank' title='Share to Pinterest'><span class='share-button-link-text'>Share to Pinterest</span></a>
</div>
</div>
<div class='post-footer-line post-footer-line-2'>
<span class='post-labels'>
Labels:
<a href='https://seanpesce.blogspot.com/search/label/linux' rel='tag'>linux</a>,
<a href='https://seanpesce.blogspot.com/search/label/privilege%2Bescalation' rel='tag'>privilege+escalation</a>,
<a href='https://seanpesce.blogspot.com/search/label/selinux' rel='tag'>selinux</a>,
<a href='https://seanpesce.blogspot.com/search/label/vulnerability' rel='tag'>vulnerability</a>
</span>
</div>
<div class='post-footer-line post-footer-line-3'>
<span class='post-location'>
</span>
</div>
</div>
</div>
<div class='comments' id='comments'>
<a name='comments'></a>
<h4>No comments:</h4>
<div id='Blog1_comments-block-wrapper'>
<dl class='avatar-comment-indent' id='comments-block'>
</dl>
</div>
<p class='comment-footer'>
<div class='comment-form'>
<a name='comment-form'></a>
<h4 id='comment-post-message'>Post a Comment</h4>
<p>
</p>
<a href='https://www.blogger.com/comment/frame/6232022754684573309?po=5346021426681410298&hl=en' id='comment-editor-src'></a>
<iframe allowtransparency='true' class='blogger-iframe-colorize blogger-comment-from-post' frameborder='0' height='410px' id='comment-editor' name='comment-editor' src='' width='100%'></iframe>
<script src='https://www.blogger.com/static/v1/jsbin/976584016-comment_from_post_iframe.js' type='text/javascript'></script>
<script type='text/javascript'>
      BLOG_CMT_createIframe('https://www.blogger.com/rpc_relay.html');
    </script>
</div>
</p>
</div>
</div>
<div class='inline-ad'>
</div>

        </div></div>
      
</div>
<div class='blog-pager' id='blog-pager'>
<span id='blog-pager-older-link'>
<a class='blog-pager-older-link' href='https://seanpesce.blogspot.com/2023/03/leveraging-ssh-keygen-for-arbitrary.html' id='Blog1_blog-pager-older-link' title='Older Post'>Older Post</a>
</span>
<a class='home-link' href='https://seanpesce.blogspot.com/'>Home</a>
</div>
<div class='clear'></div>
<div class='post-feeds'>
<div class='feed-links'>
Subscribe to:
<a class='feed-link' href='https://seanpesce.blogspot.com/feeds/5346021426681410298/comments/default' target='_blank' type='application/atom+xml'>Post Comments (Atom)</a>
</div>
</div>
</div></div>
</div>
</div>
<div class='column-left-outer'>
<div class='column-left-inner'>
<aside>
</aside>
</div>
</div>
<div class='column-right-outer'>
<div class='column-right-inner'>
<aside>
</aside>
</div>
</div>
</div>
<div style='clear: both'></div>
<!-- columns -->
</div>
<!-- main -->
</div>
</div>
<div class='main-cap-bottom cap-bottom'>
<div class='cap-left'></div>
<div class='cap-right'></div>
</div>
</div>
<footer>
<div class='footer-outer'>
<div class='footer-cap-top cap-top'>
<div class='cap-left'></div>
<div class='cap-right'></div>
</div>
<div class='fauxborder-left footer-fauxborder-left'>
<div class='fauxborder-right footer-fauxborder-right'></div>
<div class='region-inner footer-inner'>
<div class='foot section' id='footer-1'><div class='widget BlogSearch' data-version='1' id='BlogSearch1'>
<h2 class='title'>Search This Blog</h2>
<div class='widget-content'>
<div id='BlogSearch1_form'>
<form action='https://seanpesce.blogspot.com/search' class='gsc-search-box' target='_top'>
<table cellpadding='0' cellspacing='0' class='gsc-search-box'>
<tbody>
<tr>
<td class='gsc-input'>
<input autocomplete='off' class='gsc-input' name='q' size='10' title='search' type='text' value=''/>
</td>
<td class='gsc-search-button'>
<input class='gsc-search-button' title='search' type='submit' value='Search'/>
</td>
</tr>
</tbody>
</table>
</form>
</div>
</div>
<div class='clear'></div>
</div><div class='widget PageList' data-version='1' id='PageList1'>
<div class='widget-content'>
<ul>
<li>
<a href='https://seanpesce.blogspot.com/'>Home</a>
</li>
</ul>
<div class='clear'></div>
</div>
</div>
<div class='widget Profile' data-version='1' id='Profile1'>
<h2>About Me</h2>
<div class='widget-content'>
<a href='https://www.blogger.com/profile/18349249656099680276'><img alt='My photo' class='profile-img' height='80' src='//1.bp.blogspot.com/-Ssov8oejK-8/YuppO3SlDCI/AAAAAAAAAVM/XyuLxSOlUSA3c13MHPY-efFDxO3ULzAZwCK4BGAYYCw/s80/03%255B1%255D.jpg' width='79'/></a>
<dl class='profile-datablock'>
<dt class='profile-data'>
<a class='profile-name-link g-profile' href='https://www.blogger.com/profile/18349249656099680276' rel='author' style='background-image: url(//www.blogger.com/img/logo-16.png);'>
SeanPesce
</a>
</dt>
</dl>
<a class='profile-link' href='https://www.blogger.com/profile/18349249656099680276' rel='author'>View my complete profile</a>
<div class='clear'></div>
</div>
</div><div class='widget ReportAbuse' data-version='1' id='ReportAbuse1'>
<h3 class='title'>
<a class='report_abuse' href='https://www.blogger.com/go/report-abuse' rel='noopener nofollow' target='_blank'>
Report Abuse
</a>
</h3>
</div></div>
<table border='0' cellpadding='0' cellspacing='0' class='section-columns columns-2'>
<tbody>
<tr>
<td class='first columns-cell'>
<div class='foot section' id='footer-2-1'><div class='widget BlogArchive' data-version='1' id='BlogArchive1'>
<h2>Blog Archive</h2>
<div class='widget-content'>
<div id='ArchiveList'>
<div id='BlogArchive1_ArchiveList'>
<ul class='flat'>
<li class='archivedate'>
<a href='https://seanpesce.blogspot.com/2023/05/'>May 2023</a> (1)
      </li>
<li class='archivedate'>
<a href='https://seanpesce.blogspot.com/2023/03/'>March 2023</a> (1)
      </li>
<li class='archivedate'>
<a href='https://seanpesce.blogspot.com/2022/11/'>November 2022</a> (1)
      </li>
<li class='archivedate'>
<a href='https://seanpesce.blogspot.com/2022/10/'>October 2022</a> (1)
      </li>
<li class='archivedate'>
<a href='https://seanpesce.blogspot.com/2021/10/'>October 2021</a> (1)
      </li>
</ul>
</div>
</div>
<div class='clear'></div>
</div>
</div></div>
</td>
<td class='columns-cell'>
<div class='foot section' id='footer-2-2'><div class='widget Label' data-version='1' id='Label1'>
<h2>Labels</h2>
<div class='widget-content list-label-widget-content'>
<ul>
<li>
<a dir='ltr' href='https://seanpesce.blogspot.com/search/label/device'>device</a>
</li>
<li>
<a dir='ltr' href='https://seanpesce.blogspot.com/search/label/firmware'>firmware</a>
</li>
<li>
<a dir='ltr' href='https://seanpesce.blogspot.com/search/label/flash'>flash</a>
</li>
<li>
<a dir='ltr' href='https://seanpesce.blogspot.com/search/label/iot'>iot</a>
</li>
<li>
<a dir='ltr' href='https://seanpesce.blogspot.com/search/label/linux'>linux</a>
</li>
<li>
<a dir='ltr' href='https://seanpesce.blogspot.com/search/label/openssh'>openssh</a>
</li>
<li>
<a dir='ltr' href='https://seanpesce.blogspot.com/search/label/privilege%2Bescalation'>privilege+escalation</a>
</li>
<li>
<a dir='ltr' href='https://seanpesce.blogspot.com/search/label/reverse%2Bengineering'>reverse+engineering</a>
</li>
<li>
<a dir='ltr' href='https://seanpesce.blogspot.com/search/label/selinux'>selinux</a>
</li>
<li>
<a dir='ltr' href='https://seanpesce.blogspot.com/search/label/sudo'>sudo</a>
</li>
<li>
<a dir='ltr' href='https://seanpesce.blogspot.com/search/label/video%2Bgame'>video+game</a>
</li>
<li>
<a dir='ltr' href='https://seanpesce.blogspot.com/search/label/vulnerability'>vulnerability</a>
</li>
<li>
<a dir='ltr' href='https://seanpesce.blogspot.com/search/label/web'>web</a>
</li>
<li>
<a dir='ltr' href='https://seanpesce.blogspot.com/search/label/xss'>xss</a>
</li>
</ul>
<div class='clear'></div>
</div>
</div></div>
</td>
</tr>
</tbody>
</table>
<!-- outside of the include in order to lock Attribution widget -->
<div class='foot section' id='footer-3' name='Footer'><div class='widget Attribution' data-version='1' id='Attribution1'>
<div class='widget-content' style='text-align: center;'>
Powered by <a href='https://www.blogger.com' target='_blank'>Blogger</a>.
</div>
<div class='clear'></div>
</div></div>
</div>
</div>
<div class='footer-cap-bottom cap-bottom'>
<div class='cap-left'></div>
<div class='cap-right'></div>
</div>
</div>
</footer>
<!-- content -->
</div>
</div>
<div class='content-cap-bottom cap-bottom'>
<div class='cap-left'></div>
<div class='cap-right'></div>
</div>
</div>
</div>
<script type='text/javascript'>
    window.setTimeout(function() {
        document.body.className = document.body.className.replace('loading', '');
      }, 10);
  </script>
<!--It is your responsibility to notify your visitors about cookies used and data collected on your blog. Blogger makes a standard notification available for you to use on your blog, and you can customise it or replace it with your own notice. See http://www.blogger.com/go/cookiechoices for more details.-->
<script defer='' src='/js/cookienotice.js'></script>
<script>
    document.addEventListener('DOMContentLoaded', function(event) {
      window.cookieChoices && cookieChoices.showCookieConsentBar && cookieChoices.showCookieConsentBar(
          (window.cookieOptions && cookieOptions.msg) || 'This site uses cookies from Google to deliver its services and to analyse traffic. Your IP address and user agent are shared with Google, together with performance and security metrics, to ensure quality of service, generate usage statistics and to detect and address abuse.',
          (window.cookieOptions && cookieOptions.close) || 'Ok',
          (window.cookieOptions && cookieOptions.learn) || 'Learn more',
          (window.cookieOptions && cookieOptions.link) || 'https://www.blogger.com/go/blogspot-cookies');
    });
  </script>

<script type="text/javascript" src="https://www.blogger.com/static/v1/widgets/541336192-widgets.js"></script>
<script type='text/javascript'>
window['__wavt'] = 'AOuZoY62kV60GEWZ9ZKtio5iZ6N6X9nfbA:1685559830105';_WidgetManager._Init('//www.blogger.com/rearrange?blogID\x3d6232022754684573309','//seanpesce.blogspot.com/2023/05/bypassing-selinux-with-initmodule.html','6232022754684573309');
_WidgetManager._SetDataContext([{'name': 'blog', 'data': {'blogId': '6232022754684573309', 'title': 'Sean Pesce\x27s Blog', 'url': 'https://seanpesce.blogspot.com/2023/05/bypassing-selinux-with-initmodule.html', 'canonicalUrl': 'https://seanpesce.blogspot.com/2023/05/bypassing-selinux-with-initmodule.html', 'homepageUrl': 'https://seanpesce.blogspot.com/', 'searchUrl': 'https://seanpesce.blogspot.com/search', 'canonicalHomepageUrl': 'https://seanpesce.blogspot.com/', 'blogspotFaviconUrl': 'https://seanpesce.blogspot.com/favicon.ico', 'bloggerUrl': 'https://www.blogger.com', 'hasCustomDomain': false, 'httpsEnabled': true, 'enabledCommentProfileImages': true, 'gPlusViewType': 'FILTERED_POSTMOD', 'adultContent': false, 'analyticsAccountNumber': '', 'encoding': 'UTF-8', 'locale': 'en', 'localeUnderscoreDelimited': 'en', 'languageDirection': 'ltr', 'isPrivate': false, 'isMobile': false, 'isMobileRequest': false, 'mobileClass': '', 'isPrivateBlog': false, 'isDynamicViewsAvailable': true, 'feedLinks': '\x3clink rel\x3d\x22alternate\x22 type\x3d\x22application/atom+xml\x22 title\x3d\x22Sean Pesce\x26#39;s Blog - Atom\x22 href\x3d\x22https://seanpesce.blogspot.com/feeds/posts/default\x22 /\x3e\n\x3clink rel\x3d\x22alternate\x22 type\x3d\x22application/rss+xml\x22 title\x3d\x22Sean Pesce\x26#39;s Blog - RSS\x22 href\x3d\x22https://seanpesce.blogspot.com/feeds/posts/default?alt\x3drss\x22 /\x3e\n\x3clink rel\x3d\x22service.post\x22 type\x3d\x22application/atom+xml\x22 title\x3d\x22Sean Pesce\x26#39;s Blog - Atom\x22 href\x3d\x22https://www.blogger.com/feeds/6232022754684573309/posts/default\x22 /\x3e\n\n\x3clink rel\x3d\x22alternate\x22 type\x3d\x22application/atom+xml\x22 title\x3d\x22Sean Pesce\x26#39;s Blog - Atom\x22 href\x3d\x22https://seanpesce.blogspot.com/feeds/5346021426681410298/comments/default\x22 /\x3e\n', 'meTag': '', 'adsenseHostId': 'ca-host-pub-1556223355139109', 'adsenseHasAds': true, 'adsenseAutoAds': false, 'boqCommentIframeForm': true, 'loginRedirectParam': '', 'view': '', 'dynamicViewsCommentsSrc': '//www.blogblog.com/dynamicviews/4224c15c4e7c9321/js/comments.js', 'dynamicViewsScriptSrc': '//www.blogblog.com/dynamicviews/4323b1df8e5b36fa', 'plusOneApiSrc': 'https://apis.google.com/js/platform.js', 'disableGComments': true, 'sharing': {'platforms': [{'name': 'Get link', 'key': 'link', 'shareMessage': 'Get link', 'target': ''}, {'name': 'Facebook', 'key': 'facebook', 'shareMessage': 'Share to Facebook', 'target': 'facebook'}, {'name': 'BlogThis!', 'key': 'blogThis', 'shareMessage': 'BlogThis!', 'target': 'blog'}, {'name': 'Twitter', 'key': 'twitter', 'shareMessage': 'Share to Twitter', 'target': 'twitter'}, {'name': 'Pinterest', 'key': 'pinterest', 'shareMessage': 'Share to Pinterest', 'target': 'pinterest'}, {'name': 'Email', 'key': 'email', 'shareMessage': 'Email', 'target': 'email'}], 'disableGooglePlus': true, 'googlePlusShareButtonWidth': 0, 'googlePlusBootstrap': '\x3cscript type\x3d\x22text/javascript\x22\x3ewindow.___gcfg \x3d {\x27lang\x27: \x27en\x27};\x3c/script\x3e'}, 'hasCustomJumpLinkMessage': false, 'jumpLinkMessage': 'Read more', 'pageType': 'item', 'postId': '5346021426681410298', 'pageName': 'Bypassing SELinux with init_module', 'pageTitle': 'Sean Pesce\x27s Blog: Bypassing SELinux with init_module'}}, {'name': 'features', 'data': {}}, {'name': 'messages', 'data': {'edit': 'Edit', 'linkCopiedToClipboard': 'Link copied to clipboard!', 'ok': 'Ok', 'postLink': 'Post Link'}}, {'name': 'template', 'data': {'name': 'custom', 'localizedName': 'Custom', 'isResponsive': false, 'isAlternateRendering': false, 'isCustom': true}}, {'name': 'view', 'data': {'classic': {'name': 'classic', 'url': '?view\x3dclassic'}, 'flipcard': {'name': 'flipcard', 'url': '?view\x3dflipcard'}, 'magazine': {'name': 'magazine', 'url': '?view\x3dmagazine'}, 'mosaic': {'name': 'mosaic', 'url': '?view\x3dmosaic'}, 'sidebar': {'name': 'sidebar', 'url': '?view\x3dsidebar'}, 'snapshot': {'name': 'snapshot', 'url': '?view\x3dsnapshot'}, 'timeslide': {'name': 'timeslide', 'url': '?view\x3dtimeslide'}, 'isMobile': false, 'title': 'Bypassing SELinux with init_module', 'description': '\xa0     TL;DR           There are two     Linux system calls      for loading a kernel module - init_module  and finit_module . By leveraging ...', 'url': 'https://seanpesce.blogspot.com/2023/05/bypassing-selinux-with-initmodule.html', 'type': 'item', 'isSingleItem': true, 'isMultipleItems': false, 'isError': false, 'isPage': false, 'isPost': true, 'isHomepage': false, 'isArchive': false, 'isLabelSearch': false, 'postId': 5346021426681410298}}]);
_WidgetManager._RegisterWidget('_NavbarView', new _WidgetInfo('Navbar1', 'navbar', document.getElementById('Navbar1'), {}, 'displayModeFull'));
_WidgetManager._RegisterWidget('_HeaderView', new _WidgetInfo('Header1', 'header', document.getElementById('Header1'), {}, 'displayModeFull'));
_WidgetManager._RegisterWidget('_BlogView', new _WidgetInfo('Blog1', 'main', document.getElementById('Blog1'), {'cmtInteractionsEnabled': false, 'lightboxEnabled': true, 'lightboxModuleUrl': 'https://www.blogger.com/static/v1/jsbin/2226058792-lbx.js', 'lightboxCssUrl': 'https://www.blogger.com/static/v1/v-css/3268905543-lightbox_bundle.css'}, 'displayModeFull'));
_WidgetManager._RegisterWidget('_BlogSearchView', new _WidgetInfo('BlogSearch1', 'footer-1', document.getElementById('BlogSearch1'), {}, 'displayModeFull'));
_WidgetManager._RegisterWidget('_PageListView', new _WidgetInfo('PageList1', 'footer-1', document.getElementById('PageList1'), {'title': '', 'links': [{'isCurrentPage': false, 'href': 'https://seanpesce.blogspot.com/', 'title': 'Home'}], 'mobile': false}, 'displayModeFull'));
_WidgetManager._RegisterWidget('_ProfileView', new _WidgetInfo('Profile1', 'footer-1', document.getElementById('Profile1'), {}, 'displayModeFull'));
_WidgetManager._RegisterWidget('_ReportAbuseView', new _WidgetInfo('ReportAbuse1', 'footer-1', document.getElementById('ReportAbuse1'), {}, 'displayModeFull'));
_WidgetManager._RegisterWidget('_BlogArchiveView', new _WidgetInfo('BlogArchive1', 'footer-2-1', document.getElementById('BlogArchive1'), {'languageDirection': 'ltr', 'loadingMessage': 'Loading\x26hellip;'}, 'displayModeFull'));
_WidgetManager._RegisterWidget('_LabelView', new _WidgetInfo('Label1', 'footer-2-2', document.getElementById('Label1'), {}, 'displayModeFull'));
_WidgetManager._RegisterWidget('_AttributionView', new _WidgetInfo('Attribution1', 'footer-3', document.getElementById('Attribution1'), {}, 'displayModeFull'));
</script>
</body>
</html>